Skills
OX Security Audit: MCP STDIO Transport Design Flaw Exposes 200,000 Servers to Arbitrary OS Command Execution — Anthropic Calls It a Feature
OX Security confirmed arbitrary command execution on six live platforms and estimates 200K MCP servers are exposed. The root cause is not a coding bug but a design default in Anthropic's MCP specification: STDIO transport executes any OS command with no sanitization and no execution boundary between configuration and command. The flaw propagated into every official SDK (Python, TypeScript, Java, Rust) and all downstream projects. Four exploitation families identified, including unauthenticated injection through LangFlow and LiteLLM web interfaces. Anthropic's response: 'this is a feature, not a bug.'
Source
↳ Follow the thread